Know Your Business, or KYB, is the process of verifying that a company legally exists, establishing who owns and controls it, and screening those people before entering a business relationship with it.
KYC verifies a person. KYB verifies a company, and then verifies the people behind the company. That second step is why KYB takes longer, demands more, and occasionally stops at a question nobody in the finance team can answer on the first attempt.
If you are onboarding a payment provider, a bank or a settlement platform, KYB is what you are about to go through. This is what will be asked, why it is asked, and what makes it take two weeks instead of two days.
KYB and KYC, side by side
|
|
|
| Details |
KYC |
KYB |
| Subject |
A natural person |
A legal entity |
| Establishes |
That the person is who they claim to be |
That the company exists, is active, and who controls it |
| Core evidence |
Government identity document, address, liveness check |
Incorporation documents, registry record, ownership chain, director list |
| Screening |
The individual against sanctions, politically exposed person and adverse media lists |
The entity and every identified beneficial owner and director |
| Nested checks |
None |
One KYC check per beneficial owner and director identified |
| Typical duration |
Hours |
Weeks |
| Renewal |
Periodic or risk-triggered |
Periodic, plus event-driven on any ownership change |
The row that matters is the fifth. KYB contains KYC. A company with four beneficial owners and three directors generates seven individual verification checks inside one business verification, and any one of them can hold the whole file.
The terminology point. KYC applied to a company is a category error, and it is a common one. When the customer is a business, the process is KYB. Some regulators use "corporate KYC" or "customer due diligence on legal persons" for the same thing, but the subject of the verification is what decides the term.
What a KYB check actually consists of
Six components. The order varies by provider. The content does not.
One. Entity verification. Confirming the company is registered and currently active, against the official registry in its jurisdiction. Legal name, registration number, incorporation date, registered address, current status. A dissolved or struck-off entity fails here.
Two. Ownership mapping. Tracing the ownership chain to the natural persons at the end of it. Where a company is owned by another company, which is owned by a trust, the chain is followed through each layer. This is the step that consumes the time.
Three. Beneficial owner identification. Naming the individuals who ultimately own or control the entity. The Financial Action Task Force defines a beneficial owner as the natural person who ultimately owns or controls a customer, including through indirect means. Most regimes set the threshold at twenty-five percent of shares or voting rights, with a separate control test that captures individuals with decision-making authority regardless of the percentage they hold.
Four. Individual verification on each of them. A full KYC check on every beneficial owner and, in most regimes, every director.
Five. Screening. The entity and each identified individual against sanctions lists, politically exposed person lists and adverse media. Jurisdiction risk is assessed here, including whether the entity or its owners sit in a country on the FATF grey or black list.
Six. Risk classification and ongoing monitoring. A risk score that determines the depth of review, and a schedule for refreshing it. Higher-risk classifications trigger enhanced due diligence: source of funds, source of wealth, business purpose and, in many institutions, senior approval before the account opens.
Where the requirement comes from
KYB is not a single regulation. It is the corporate application of a customer due diligence obligation that appears in almost every anti-money laundering regime, and those regimes trace back to a common source.
The Financial Action Task Force sets the international standard. Recommendation 24 requires countries to ensure that authorities can access adequate, accurate and up-to-date beneficial ownership information for companies, and it was strengthened in March 2022 with implementation guidance following. Recommendation 25 covers the same ground for trusts and similar arrangements. Recommendation 10 places the customer due diligence obligation on the institution. Recommendation 11 sets a five-year floor on record retention.
National regimes implement that standard, and they do not implement it identically.
How the rules differ across corridors
The variation is not cosmetic. Threshold, evidence standard and registry access all move by market.
|
|
|
|
| Market |
Primary instrument |
UBO threshold |
Note |
| European Union |
Regulation (EU) 2024/1624, AMLR |
Twenty-five percent or more, reducible to fifteen percent in high-risk sectors |
Applies from 10 July 2027. Replaces the directive patchwork with one rulebook. Requires the identification reasoning itself to be documented |
| United States |
Bank Secrecy Act, FinCEN CDD Rule |
Twenty-five percent plus a substantial control test |
Institutions still perform KYB. Separately, a March 2025 interim final rule removed the Corporate Transparency Act filing obligation for US-formed companies. Only foreign entities registered in a state now file |
| Canada |
PCMLTFA |
Twenty-five percent |
Money services businesses register with FINTRAC and apply KYB to corporate clients |
| India |
RBI KYC Master Direction, PMLA |
Twenty-five percent |
Corporate documentation typically includes incorporation certificate, PAN, GST registration and board authorisation |
| Singapore |
MAS Notice 626 |
Risk-based |
In 2025 MAS fined nine institutions a combined twenty-seven million Singapore dollars over ownership verification and source of wealth failures connected to a three billion dollar laundering case |
| United Arab Emirates |
Federal AML framework, free zone registries |
Twenty-five percent |
Free zone and mainland entities present different registry evidence |
| Philippines |
BSP AML regulations |
Twenty-five percent |
SEC registration and beneficial ownership declaration are the standard evidence set |
Positions as at August 2026.
Two consequences follow for a business operating across several of these.
A KYB file built for one market does not automatically satisfy another. A programme designed against MAS expectations does not clear RBI requirements, and the evidence a European provider accepts may not be what a Gulf provider asks for.
Most published guidance is out of date on the United States. Any article written before March 2025 overstates the domestic filing obligation. The reporting rule changed. The institutional obligation to perform KYB did not.
Why it takes two weeks
Providers rarely explain the delay, so businesses assume it is inefficiency. Usually it is one of five things.
The ownership chain has more layers than the form anticipated. A holding company above an operating company above a nominee arrangement takes manual work to resolve.
The registry is slow, offline or not machine-readable. Registry access quality varies enormously by jurisdiction and is the single largest source of variance in KYB turnaround.
A beneficial owner is unreachable. Every identified owner needs an individual check. One owner travelling without document access holds the file.
A screening hit needs resolution. Common name matches against sanctions or politically exposed person lists are frequent and require manual clearance. This is normal and is not an accusation.
The documents disagree. The registry says one thing, the shareholder agreement says another, the cap table says a third. Reconciling them takes correspondence.
Businesses that clear KYB quickly do one thing differently: they assemble the pack before starting. Incorporation certificate, current registry extract, ownership structure to natural persons, director list, identity documents for each beneficial owner and director, and a short written description of what the business does and where the money comes from.
What KYB does not do
Two limitations worth stating.
KYB verifies the structure and the people, not the commercial conduct. A company can pass KYB cleanly and still behave badly afterwards, which is why ongoing monitoring exists as a separate obligation rather than as a formality.
KYB is only as good as the registry underneath it. In markets where beneficial ownership registers are incomplete, unverified or closed to the private sector, a KYB check depends on documents supplied by the entity being checked. Regulators have been explicit that reliance on registry data alone is not sufficient, and independent verification is expected.
Enforcement reflects this. In November 2025 the German regulator BaFin imposed a forty-five million euro penalty on J.P. Morgan SE over anti-money laundering control failures. In July 2025 the Financial Conduct Authority fined Monzo twenty-one million pounds over customer due diligence and monitoring failings. In both cases the finding concerned the quality of the ownership work, not the absence of a policy.
KYB once, then payouts
For a business making cross-border payouts, the practical question is how often this happens. On a well-designed platform, once.
zPayments completes KYB on the sending entity at onboarding. After that, payouts run against the verified entity rather than triggering a fresh verification each time, and screening applies per payout at the transaction level rather than by reopening the file. Compliance checks run on the platform rather than on the sender.
